Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

An anonymous reader writes "Google search terms have helped convict a wireless hacker. The queries the hacker performed were introduced into evidence at court, where Matthew Schuster was charged with disrupting his former employer's wireless network and imitating other users' MAC addresses to obtain access. From the article: 'Court documents are ambiguous and don't reveal how the FBI discovered his search terms. That could have happened in one of three ways: an analysis of his browser's history and cache; an Alpha employee monitoring the company's wireless connection; or a subpoena to Google from the police for search terms tied to his Internet address or cookie. Google has confirmed that it can provide search terms if given an Internet address or Web cookie, but has steadfastly refused to say how often such requests arrive.'

Google has confirmed that it can provide search terms if given an Internet address or Web cookie, but has steadfastly refused to say how often such requests arrive. (Microsoft, on the other hand, told us that it has never received such queries for MSN Search, and AOL says it could not provide the information if asked.)

The thing is that I highly doubt that they got the search results from Google. My money is on that he had auto-complete turned on. No non-tech head has the sense to turn this off. I've found credit card numbers in some of my friend's auto-complete histories. Hit the down arrow key at the Google page when your on the search box, and you can get a fairly long list of previously searched items. This kind of stuff doesn't require any kind of court order with Google.

The difference is that yes, in this case, a malicious "hax0r" does get put away... but in Yahoo!'s case, they did the same to a journalist who desires freedom in an oppressive communist state. They're two different things.

Even so, I don't think Google was the source of the search terms- they have adamantly stood their ground against such practices in the past. I just don't see them taking a 180 and just giving the FBI search terms like that.

The difference is that yes, in this case, a malicious "hax0r" does get put away... but in Yahoo!'s case, they did the same to a journalist who desires freedom in an oppressive communist state. They're two different things.

What's the difference? In both cases somebody was breaking a law in their country. And in both cases the search engines gave relevant information to the governments of those countries. They seem almost exactly the same to me.

Murder and self-defense are exactly the same if you describe them both only as "using a firearm to cause a person to die". The context is important; and to some of us, suppressing free speech is not equivalent to punishing someone for breaking into a former employer's network in order to damage it.

"The context is important; and to some of us, suppressing free speech is not equivalent to punishing someone for breaking into a former employer's network in order to damage it."

The Chinese would say the same thing; they were just punishing someone for spreading lies and propaganda in an attempt to destabilize the government. Not that they are right, just remember, everyone has excuses.

Murder and self-defense are exactly the same if you describe them both only as "using a firearm to cause a person to die". The context is important; and to some of us, suppressing free speech is not equivalent to punishing someone for breaking into a former employer's network in order to damage it.

If you're going to do business in a country, you're obligated to follow their laws, whether you like them or not. If Google or Yahoo wants to make a statement about a country's policies, breaking the law isn'

when Yahoo does something like this, they are teh Evil!!!!11!!one!But when Google does it, it can only be for the common good, right? A malicious Hax0r gets put away??

No. You make it sound like all/.ers blindly believe anything Google does is correct. Google knows how to play this crowd, and there is nothing wrong with that. You're the real problem here because of how you trivialize the issues to make it seem like a popularity contest. Some people here might think that way, but most probably do not...

"Can you see the differences? Do you see why Yahoo HK was evil, but Google was not? Hong Kong is a seperate government than mainland China."

Umm, no.

http://en.wikipedia.org/wiki/Hong_Kong [wikipedia.org]
"The Hong Kong Special Administrative Region of the People's Republic of China (Traditional Chinese: [pronunciation]) is one of the two special administrative regions (SARs) of the People's Republic of China (PRC), the other being Macau, and one of the richest cities in the world."

Do you see why Yahoo HK was evil, but Google was not? Hong Kong is a seperate government than mainland China. Yahoo in Hong Kong had no legal requirement to cooperate with mainland Chinese police (first evil deed). Then, Yahoo stated that they will comply with local "customs".

Why do you say that Hong Kong is a separate government than mainland China? For historical and political reasons, HK is (for a while) treated a little differently, but since 1999(?) it's a part of the People's Republic of China. Yaho

Why do you say that Hong Kong is a separate government than mainland China?

Poor wording on my part. It's part of China proper, but has its own government and political structure officially known as Hong Kong Special Administrative Region of the People's Republic of China. (see: Honk Kong [wikipedia.org]) It reminds me of D.C., which while not at all the same, is not a city on to itself, but rather a entirely seperate federal entity coupled with the city of Washington, Maryland.

Google only shares personal information with other companies or individuals outside of Google in the following limited circumstances:
* We have your consent. We require opt-in consent for the sharing of any sensitive personal information.
* We provide such information to our subsidiaries, affiliated companies or other trusted businesses or persons for the purpose of processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Policy and any other appropriate confidentiality and security measures.
* We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce applicable Terms of Service, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, or (d) protect against imminent harm to the rights, property or safety of Google, its users or the public as required or permitted by law.

That's a pretty broad policy. *ANY* applicable law, regulation, legal process or enforeable governmental request. That leaves the door pretty wide open for the Chinese government to start asking for the query strings of their citizens to me.

I think the answer is clear, if you need to see webpages and want NO trace of you - you have to compromise a machine, surf via a proxy you set up in it, and then timebomb the drive to wipe itself after you are done. And even then you may get caught, if there are firewall logs.

DISCLOSURE
All use of our site is confidential. We disclose user information only as provided for herein and when we believe that the law requires it, or when disclosure is necessary to identify, contact or bring legal action against someone who may be causing injury to others or interfering with Proxify's rights or property.

In the event of an assignment, sale, joint venture, or other transfer or disposition of some or all of the assets of Proxify, you agree that we can accordingly assign, sell, license or transfer any information that our users have provided to us. Please note, however, that the purchasing party cannot use the personal information you have submitted to us under this Privacy Policy in a manner that is materially inconsistent with this Privacy Policy without your prior consent.

That pretty much says: hey, we have your web surfing logs and we'll give em up if we have to. We don't want to, and we'll destroy logs after 30 days (it says that elsewhere in the policy) but dammit, if they bend us over and lube us up - we're gonna damn well hand it over rather than taking one for the team, so to speak.

We disclose user information only as provided for herein and when we believe that the law requires it, or when disclosure is necessary to identify, contact or bring legal action against someone who may be causing injury to others or interfering with Proxify's rights or property.

But we don't want google disclosing our information based on what they believe. That's up to law enforcement. If law enforcement believes a crime has been committed let them get a warrant and subpoena google for the information.

I seem to recall that there is a legal obligation to report certain classes of suspicious activity if they become aware of it -- notably, child pornography. They may not be obligated to actively search for it, but if they spot indications that a user is involved in that while analyzing their logs...

If someone is charged in one country for what is done with servers located in another country, it stands to reason they're liable for what they did in the origin country. International treaties specify information sharing between various security and police forces, so any company has to comply with such requests. If a country signs up to an international treaty, then the people and businesses in that country have to abide as best they can.

None of that matters when they get the letter. They have to fork it over regardless of what agreement you made with them at that point anyway.I just wonder how long it will take to start general 'fishing expeditions' of search history to show 'possible intent' of comitting a crime and get warrants based on that 'suspicion'. " we see here you did a search for the word crack, come with us". " we dont care that what you have searched for might have been legal when you searched, its not now".

There are numerous ways to make yourself anonymous, however, they are for another discussion. Which is why I just suffice to say this guy is a piss-poor hacker.

He didn't even try. He was just a disgruntled IT worker. Instead of using a machine gun to mow people down he wanted to use a transmitter to mow packets down. In this day and age people take that very seriously. So he's going to jail for 15 months. End of story.

Definitely a bad hacker. The only way that Google could keep his search terms and link them directly to him as a person would be if he were logged into his Gmail account when he was searching for the help he sought (or if he did them while sitting at his desk at work or home). Had he been smart, he would have done all the research from a public terminal in a library or university where no logon is needed. But we've already established that he wasn't smart. His imprisonment is not an effective disincentive t

Yeah it's called spoofing. MACs are easy, as this was one of the things the guy in the article was doing. I myself did the same thing back in college for WiFi in certain buildings. I simple packet sniffing can yield some great things. IP spoofing is likely to be done, but good luck on getting a response from your target, at least with out some other tricky means.

I am no hacker and I do use google for many searches that I would not like to be a public information. Let us come clean, how many of us have not searched for a mp3 we liked a lot, or p0rn, or how to bypass company firewall?

The first thing he should have done is to delete Cache, browse anonymously, and FOR GOD'S SAKE, not be logged into google (which is integrated everywhere), or delete search history, or delete all cookies!

I know because I have suffered from this kind of stupidity, and in the end, I was unable to blame anyone.

Actually, the first thing he should have done was to stop using his former employer's wireless network by appropriating its other customers MAC addresses to gain illegal access. The second thing he should have done was to not launch DOS attacks against said customers' websites. That automatically raised damages to above $5000 which led to the FBI getting involved. Once that happened, he was screwed.

> That could have happened in one of three ways: an analysis of his browser's history and cache; an Alpha employee monitoring the company's wireless connection; or a subpoena to Google from the police for search terms tied to his Internet address or cookie.

...or by simply getting a judge to approve the running of a query against a database consisting of all traffic to/from the routers that constitute the edges of Google's network, without confirming or denying the existence of such a database.

Wow..That's probably Overkill for this case... More than likely.. the Business suspect the guy is the perp and Either Takes his work machines and has analysis done on the Web Cache/History to see what this guy is looking at while using that PC OR Law Enfocement gets the bad guys computer, which said bad guys thinks will never be looked at, and with a Search Warrant the Computer is analyzed and Google search terms pop up and are introduced as evidence in trial.. Not really a big deal... and happens ev

This is why people who actually want to secure a wireless network use some combination of Radius and VPNs...

That's also one way to maintain an open network for casual surfers without compromising your home/business network. Put the wireless net on the Internet side of a firewall. Only VPN users get to cross the firewall and play on the company Intranet.

The Linksys router Schuster used at his home and its MAC address proved that he was accessing the CWWIS wireless network.

Sounds like the MAC address was tied to his name somewhere and this was the evidence the FBI used to obtain the warrant. After that, everything was revealed by the contents of his computer.

If you purchase a network card online with a credit card it's possible that the FBI can trace the MAC address of that card back to you, providing the seller keeps records. If you're a linux user you can change your MAC address with,

ifconfig ethX hw ether xx:xx:xx:xx:xx:xx

As long as you don't pass traceable information (like logging onto a traceable email account) and you use an anonymous proxy like tor [eff.org] as extra protection, it's pretty difficult to trace you. It's possible, of course, to locate you physically by triangulating your radio signals but this requires a bit more effort.

The above is provided for educational purposes only. I do not advocate breaking the law.

Interesting, Now I can use skype to make 100% anonymous phone call
All I gotta do just change my MAC addr then find a good wi-fi spot, then register a new skype account.
Only 9 days left for the FREE skype phone call to US.

The MAC address can be changed [nthelp.com] in Windows as well, which is probably not such a bad idea all things considered. If you want any privacy these days you have to secure it for yourself because nobody else cares anymore and some are actively trying to subvert it.

You don't need to worry about the MAC address of your NIC. That does not go out over the wire to web servers. The MAC they are talking about the MAC of the router. That is what the outside world see's not the MACs of your internal NICs.

None of your MAC addresses go over the wire to web servers, unless the web servers are on the same physical network as you.

None of your MAC addresses go over the wire to web servers, unless the web servers are on the same physical network as you.

Two scenarios to keep in mind:

(1) You're surfing on a wireless hotspot that isn't yours, e.g. you're at starbux, or using a neighbor's router. You download something that The Man gets interested in. The Man then requests access to the (starbux's or neighbor's) router, and gleans your mac address from it.

(2) You're surfing on the wireless router in your own home. You think you'r

I know that Google analyzes the searches of its users -- for good purposes. I am sure they analyze how their search works, how users use it, and other things about those users. This helps them make a better tool. What I'm worried about is when this information is used to profile users, and identify potential 'terrorists'.

"In October 2003, police armed with a search warrant showed up and seized his computer (PDF)."

Ouch, this brings back memories of Hackers [imdb.com]. As cheesy as it was, that movie hit close to home because I had gotten in trouble so many times in the past all through my earlier years in school, being banned from a total of four or so different school computer labs (three different schools) by the age of 13... One of the better stories: I was snooping around on the computer's hard drive using Netscape by browsing "fil

One of the best tricks I ever came up with was building my own HyperCard [wikipedia.org] stack to launch whatever program I wanted, after discovering a pretty big bug in the school's "security" software. Our Mac labs had At Ease [wikipedia.org], and it would only have just a few "educational" programs etc. available to students. However, I found a really big vulnerability - you could take any program and simply change the creator code with ResEdit [wikipedia.org] to match that of any one of the "allowed" programs, and it would then be allowed to run.

Here [phroggy.com]'s a HyperCard stack I created to disable FoolProof, which prevented users from dragging icons in the Finder (and probably did a couple of other things, but that was the main feature I remember).

One of the better stories: I was snooping around on the computer's hard drive using Netscape by browsing "file:///", which was apparently "hacking". Curiosity killed the cat, I guess.

Wow, your sysadmin was a real jerk. I actually got caught pirating using the school network (lesson learned: pirating to just anyone is asking for trouble), which got me banned until they found out they needed geeks to operate PageMaker for the yearbook. hahaha:) The librarians just sighed every time I used the computer -- the latest attempts to keep the hackers out inevitably failed.

Yeah, it was actually on a library computer I was on, too, so I was banned from the library's computers... until a couple years later when I was suddenly recruited to help keep the library network running in the school... heh!

This kind of proxy is very common on businesses and among other useful stuff they log the HTTP request made by any client in the network. This is the easiest way, noone else is requiered to get the queries just check your own server logs.

Yeah, I suppose in this case that is probably true. But proxies generally only log the URL visited. So queries sent to a web site would only show up if HTTP GET was used AND your particular proxy gathered additional path information from the URL to put into the log (I know that my Squid proxy does not gather such information, it only logs the base URL path). HTTP POSTs probably would not show up at all unless some other mechanism was enabled/added to the proxy.

Am I alone for thinking that 15 months in prison, three years of probation, and $20k in restitution is just a LITTLE high for MAC spoofing to score some free wifi? Even if it was taken to the level of interfering with the signal, 2.4G is unlicensed. As any aspiring hacker should know, a properly configured [amasci.com] microwave will cause wifi (and 2.4G phones and baby monitors) many problems. Unless he was pulling some seriously bad juju, this is Mitnick-esque "damages".

He wasn't just looking to score some free wifi, he was actively interfering with his former employer's business operations by DOS'ing customer websites, and knocking customers offline. To me, the sentence is appropriate. In fact, he's lucky to get what he got compared to some of the draconian sentences handed to other hackers in other criminal cases for doing far less than what he did.

He was doing more then getting free wifi. He launched a DOS against his former companies customers. This guy got exactly what he deserved. The moral of the story? Don't break into your former employer's wireless and start locking DOS attacks or else you get thrown in jail. If anything, I think the guy got off light.

In this day and age where anybody can wardrive past your place and do God knows what with your Internet connection (provided your WAP isn't secured), how can simple Google query logs prove ANYTHING? For all we know, this guy had an enemy at work who decided to set him up.

And if he doesn't have a WAP, or it's secured, then it's just as possible that the aforementioned enemy somehow hacked into this guy's computer and sent those queries.

True, but the GP's point is still valid... conviction based solely upon server log entries (or even the use of such logs to intimidate, such as the RIAA has been doing) should simply be unacceptable to a judge. Such information being a part of the fabric of evidence in a larger case is one thing, but it is simply not reliable enough to be depended upon in such important matters.

Courts need to become more technically competent, I think. We're too accustomed to the idea that if data comes from a computer it is implicitly trustworthy, and that's a big problem.

Well, I have heard this sort of thing being used to explain why you should leave your wireless access point wide open. The argument goes that, if you secure it, evidence in packets coming from it can be used against you. But if you don't secure it, those packets could have come from any passerby.

Wasn't this argued here on/. sometime recently? But I'm not sure I want to be a test case.

Still: he wasn't convicted based solely upon server log entries, was he? I don't know about you, but I certainly don't believe that data that comes from a computer is "implicitly trustworthy", and I don't think that a lot of people do. Quite the opposite, as a matter of fact. I don't know why you bring up the RIAA, but their actions are rarely defendable.

People have implicit trust in computers and software because, for most of them, they simply have no choice. They have to assume that what the computer tells them is accurate, because otherwise they can't do their jobs. I cannot tell you the number of times, in the past twenty-five years, that I've delivered a custom data acquisition system and asked the customer to do an end-to-end test on it to verify the accuracy of the results. "Nah, we trust you" I would often get told, to which I would say, "No! Don't

Hmmm... A few months ago, I did a number of google searches with very similar terms. I was trying to find out how to diagnose and defend against some wireless interference. Not that I learned all that much. I suspect that you need some rather special equipment to locate the source of interference, but I don't know what that equipment might be.

Anyway, I wonder if I could be a suspect now because of those searches?

I have noticed in the past that if you ask questions about security, you're usually treated as if you were a potential security risk, not as someone trying to improve your own security.

In this instance it would be like talking to person X on company Y's premises. Company Y certainly has a right to know what is going on in their building and if it's illegal have every right to call the police about it.

Your metaphor is rendered invalid when the receiving end of your conversation is a corporate entity residing on a public domain. Google has every right to surrender any information it may have. Whether it's ethical to do so remains another, entirely different question. Don't be evil!!!

Because Google can say ANYTHING it wants about you and people/police/FBI/government/corporations/your_emp loyer/etc will believe them without an OPEN REVIEW of how they obtain, generate, and store that information.

Is the information faulty? Did someone munge with the data? Were Google's databases corrupt? Was the data recreated or generated from other data? Has Google's spy software been through open source review? How well was Google's software tested?

That's like looking at a key eye witness who saw you stab Nicole Brown Simpson and saying "How do I know you weren't on LSD and just imagining me there?" Seriously, independent third party witnesses are key to the judicial process. Get over yourself. Google openly makes money on the fact that they keep track of your browsing habits in order to make their advertising revenue more beneficial to their paying customers. Google could plaster those records for everyone on the planet to see them and your right

That's like looking at a key eye witness who saw you stab Nicole Brown Simpson and saying "How do I know you weren't on LSD and just imagining me there?"

Funny, yes. But I have a story that's not too far off from that sort of thing. About 10 years ago I was working on a project at a big corporation whose name isn't relevant here. I had a row of machines with different OSs for doing portability testing. Someone sent me email pointing to a bit of humor on some web site, and by chance I happened to read it on

One of my "bosses", who is responsible for security control of our Active Directory domain was utterly mystified that I could log into a dozen or so PCs in 4 different offices and change the Domain that they belong to without leaving my chair. She had never heard of VNC let alone FastPush. Her expectation was that I would physically walk to each desk and do this in turn.
With that level of comprehension and that level of responsibility, it would be SO easy to scatter red herrings throughout the enterprise.

We're reaching the stage where you can be convicted for what you computer does behind your back.

I respectfully disagree. Many people have experienced their computers doing things they never wanted and don't understand, and I think (perhaps overly optimistically) that the courts will be sympathetic if somebody discovers (e.g.) that your computer has been downloading child pornography at 12:30am every night and saving it in your browser cache, if you claim you weren't aware of it and don't know how to make it stop.

Stories like this are good for explaining why everyone really needs to learn enough about how their software works that you can block things like this that can plant evidence on your machine.

Considering how much of the modern Web you'd be shutting yourself out from if you disabled JavaScript, I wouldn't view that as a solution. What are some other lessons you think novice computer users need to learn, that would have prevented this particular problem from arising? Can you clearly explain the reasons to your mother? Have you done so?

That's like looking at a key eye witness who saw you stab Nicole Brown Simpson and saying "How do I know you weren't on LSD and just imagining me there?" Seriously, independent third party witnesses are key to the judicial process. Get over yourself.

In a (sane) legal proceeding, there are resources allocated to evaluating the likelihood of scenarios proposed by either side. If one side posits that one of the witnesses may be unreliable because of being on LSD, the assertion isn't just tossed out... it's

It continually astounds me how the American people are willing to look the other way when it comes to their liberty and civil rights being encroached on!

Dude, the American people just looked the other way when the US government allowed itself to torture prisoners, and compromised just about every tenet of a fair trial. And you want us to care about web cookies and browser logs and shit?

Is the information faulty? Did someone munge with the data? Were Google's databases corrupt? Was the data recreated or generated from other data? Has Google's spy software been through open source review? How well was Google's software tested?